Tres backends de autenticación comunes

1. passwd-file (instalaciones pequeñas y estáticas):

/etc/dovecot/users:

alice@example.com:{SHA512-CRYPT}$6$abc...:5000:5000::/var/mail/vhosts/example.com/alice

conf.d/10-auth.conf:

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
}
userdb {
  driver = passwd-file
  args = username_format=%u /etc/dovecot/users
}

2. SQL (la mayoría de los entornos de hosting):

conf.d/auth-sql.conf.ext:

passdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }
userdb { driver = sql; args = /etc/dovecot/dovecot-sql.conf.ext }

/etc/dovecot/dovecot-sql.conf.ext:

driver = mysql
connect = host=127.0.0.1 dbname=mail user=mail password=secret
default_pass_scheme = SHA512-CRYPT
password_query = SELECT email AS user, password FROM users WHERE email='%u' AND active=1
user_query = SELECT '/var/mail/vhosts/%d/%n' AS home, 5000 AS uid, 5000 AS gid, \
  CONCAT('*:bytes=', quota_bytes) AS quota_rule FROM users WHERE email='%u'

3. LDAP (empresas): conf.d/auth-ldap.conf.ext con hosts, base, pass_filter, user_filter. Funciona muy bien con FreeIPA, Samba AD y OpenLDAP.

🎯 Cifra siempre las contraseñas con SHA512-CRYPT o ARGON2I. Nunca las guardes en texto plano, en MD5 o en SHA-1 sin sal.